Whonix live mode / amnesia / amnesic / non-persistent / anti-forensics

Development
244
245
1 Like
246

Added to Combine Kicksecure ™ Live VMs with Read-only Mode for Virtual Hard Drives chapter VirtualBox in Kicksecure wiki just now:

On Debian bookworm based Kicksecure ™ 17 (and above) / Newer VirtualBox versions:

  • VirtualBox might no longer support VBoxInternal/Devices/lsilogicsas/0/LUN#0/AttachedDriver/Config/ReadOnly. Settings set thorugh VBoxManage setextradata are not officially supported and might be gone at some time such as now.
  • VirtualBox documentation chapter Special Image Write Modesarchive.org mentions immutable images but this might not be as good as read-only images.
1 Like
247

Above two issues are not easy to fix.

Help welcome!

Link to source code:

1 Like
248

rootovl vs overlayfs discussed here:
Boot Existing, Usual Linux Installation from Hard Disk in Live Mode / read-only mode with dracut · Issue #1565 · dracutdevs/dracut · GitHub

1 Like
249

https://www.reddit.com/r/Whonix/comments/15q7vcs/have_the_dev_team_tested_the_antiforensic/

2 Likes
250

issue with older build versions still using initramfs-tools and fix:

1 Like
251
1 Like
252

Merged.

1 Like
253

grub-live boot menu entry adding still having issues.

sh -x /etc/grub.d/11_linux_live

+ true grub-live /etc/grub.d/11_linux_live: START
+ set -e
+ set -o allexport
+ GRUB_DEVICE=/dev/disk/by-uuid/
+ unset GRUB_DEVICE_UUID
+ GRUB_DISTRIBUTOR=LIVE mode USER (For daily activities.)
+ GRUB_DISABLE_RECOVERY=true
+ pkg_installed initramfs-tools
+ local package_name
+ package_name=initramfs-tools
+ dpkg-query --show --showformat=${Status}\n initramfs-tools
+ [ deinstall ok config-files = install ok installed ]
+ true grub-live /etc/grub.d/11_linux_live: INFO: initramfs-tools is NOT installed.
+ return 1
+ pkg_installed dracut
+ local package_name
+ package_name=dracut
+ dpkg-query --show --showformat=${Status}\n dracut
+ [ install ok half-configured = install ok installed ]
+ true grub-live /etc/grub.d/11_linux_live: INFO: dracut is NOT installed.
+ return 1
+ echo grub-live /etc/grub.d/11_linux_live: ERROR: Neither initramfs-tools nor dracut is installed. Support for other initrd generators is not implemented. This means that no live mode boot menu entry will be added.

grub-live /etc/grub.d/11_linux_live: ERROR: Neither initramfs-tools nor dracut is installed. Support for other initrd generators is not implemented. This means that no live mode boot menu entry will be added.

+ exit 0

dpkg -l | grep dracut

ii  dracut                                059-4                                   all          Initramfs generator using udev
ii  dracut-core                           059-4                                   amd64        dracut is an event driven initramfs infrastructure (core tools)
ii  grub-live-dracut                      3:5.8-1                                 all          grub live dracut dependencies

The problem is, the output of dpkg-query is difficult to parse and it’s exceptionally difficult to reliably programatically detect package installation status.

1 Like
254

Fixed.

Available in all repositories.

1 Like
255
1 Like
256
257